department of health and human servicesthese issues occurred because: (1) oregon provided...

Department of Health and Human Services

OFFICE OF INSPECTOR GENERAL

OREGON’S OVERSIGHT DID NOT ENSURE

THAT FOUR COORDINATED-CARE

ORGANIZATIONS COMPLIED WITH

SELECTED MEDICAID REQUIREMENTS

RELATED TO ACCESS TO CARE AND

QUALITY OF CARE

Christi A. Grimm

Principal

Deputy Inspector General

September 2020

A-09-18-03035

Inquiries about this report may be addressed to the Office of Public Affairs at

[email protected].

mailto:[email protected]

Office of Inspector General https://oig.hhs.gov

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as amended, is

to protect the integrity of the Department of Health and Human Services (HHS) programs, as well as the

health and welfare of beneficiaries served by those programs. This statutory mission is carried out

through a nationwide network of audits, investigations, and inspections conducted by the following

operating components:

Office of Audit Services

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting audits with

its own audit resources or by overseeing audit work done by others. Audits examine the performance of

HHS programs and/or its grantees and contractors in carrying out their respective responsibilities and are

intended to provide independent assessments of HHS programs and operations. These audits help reduce

waste, abuse, and mismanagement and promote economy and efficiency throughout HHS.

Office of Evaluation and Inspections

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide HHS, Congress,

and the public with timely, useful, and reliable information on significant issues. These evaluations focus

on preventing fraud, waste, or abuse and promoting economy, efficiency, and effectiveness of

departmental programs. To promote impact, OEI reports also present practical recommendations for

improving program operations.

Office of Investigations

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations of fraud and

misconduct related to HHS programs, operations, and beneficiaries. With investigators working in all 50

States and the District of Columbia, OI utilizes its resources by actively coordinating with the Department

of Justice and other Federal, State, and local law enforcement authorities. The investigative efforts of OI

often lead to criminal convictions, administrative sanctions, and/or civil monetary penalties.

Office of Counsel to the Inspector General

The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, rendering

advice and opinions on HHS programs and operations and providing all legal support for OIG’s internal

operations. OCIG represents OIG in all civil and administrative fraud and abuse cases involving HHS

programs, including False Claims Act, program exclusion, and civil monetary penalty cases. In

connection with these cases, OCIG also negotiates and monitors corporate integrity agreements. OCIG

renders advisory opinions, issues compliance program guidance, publishes fraud alerts, and provides

other guidance to the health care industry concerning the anti-kickback statute and other OIG enforcement

authorities.

Notices

THIS REPORT IS AVAILABLE TO THE PUBLIC at https://oig.hhs.gov

Section 8M of the Inspector General Act, 5 U.S.C. App., requires that OIG post its publicly available reports on the OIG website.

OFFICE OF AUDIT SERVICES FINDINGS AND OPINIONS

The designation of financial or management practices as questionable, a recommendation for the disallowance of costs incurred or claimed, and any other conclusions and recommendations in this report represent the findings and opinions of OAS. Authorized officials of the HHS operating divisions will make final determination on these matters.

https://oig.hhs.gov/

Report in Brief

Date: September 2020 Report No. A-09-18-03035

Why OIG Did This Audit In 2012, Oregon was one of the first States to adopt a type of Medicaid accountable care organization when it established coordinated care organizations (CCOs). A CCO is a network of different types of participating providers that have agreed to work together in their local communities to provide coordinated care to Medicaid beneficiaries. Two goals of the CCO model are to improve access to care and the quality of care.

Our objective was to determine whether Oregon’s oversight ensured that four CCOs complied with selected Federal and State Medicaid requirements related to access to care and quality of care.

How OIG Did This Audit We judgmentally selected four CCOs in Oregon and visited them to obtain a general understanding of their policies and procedures related to selected access-to-care and quality-of-care requirements. We selected one CCO that served an urban area, one CCO that served a rural area, and two CCOs that served a mix of urban and rural areas. We had no expectation that the four CCOs would be representative of all CCOs.

We reviewed the following areas at each CCO: the provider credentialing process, beneficiary grievance and appeals processes, compliance with time and distance standards and timely access standards, and assignment of primary care providers (PCPs). Our audit period was calendar years 2016 and 2017.

The full report can be found at https://oig.hhs.gov/oas/reports/region9/91803035.asp.

Oregon’s Oversight Did Not Ensure That Four Coordinated-Care Organizations Complied With Selected Medicaid Requirements Related to Access to Care and Quality of Care What OIG Found The CCOs generally complied with Federal and State requirements related to time and distance standards and timely access standards, as well as requirements related to assignment of PCPs. However, the CCOs did not comply with requirements related to provider credentialing and beneficiary grievances and appeals. Specifically, CCOs: (1) did not ensure that services were provided within the scope of license of a provider with a restricted license or report providers with licensing board actions against them, (2) did not credential all provider types (e.g., mental health providers), and (3) did not perform or document all minimum required credentialing checks. In addition, CCOs did not resolve or review beneficiary grievances appropriately and did not adjudicate appeals in compliance with their contracts with Oregon. Also, CCOs submitted inaccurate or incomplete data on grievances and appeals, which Oregon used for oversight. These issues occurred because: (1) Oregon provided insufficient oversight of, and guidance to, the CCOs and (2) the CCOs provided insufficient oversight of, and guidance to, their subcontractors. Because not all providers were appropriately credentialed, there was an increased risk of poor quality of care. In addition, the mishandling of grievances and appeals may have reduced beneficiaries’ access to care and the quality of care.

What OIG Recommends and Oregon Comments We recommend that Oregon provide additional guidance to CCOs on: (1) the processes for provider credentialing and for beneficiary grievances and appeals and (2) monitoring subcontractors. We also recommend that Oregon take actions to: (1) ensure that CCOs do not subcontract the adjudication of final appeals and (2) ensure that the data that CCOs submit on grievances and appeals are accurate and complete. In written comments on our draft report, Oregon stated that it acknowledged our findings, supported our recommendations, and was committed to making improvements for the areas in which our findings indicated areas of concern. In addition, Oregon provided information on actions that it had taken or planned to take to address our recommendations. For example, Oregon stated that it would determine the feasibility of universal application and credentialing procedures at the State level.

https://oig.hhs.gov/oas/reports/region9/91803035.asp

TABLE OF CONTENTS

INTRODUCTION............................................................................................................................... 1

Why We Did This Audit ....................................................................................................... 1

Objective ............................................................................................................................. 1

Background ......................................................................................................................... 1 The Medicaid Program and the State Agency’s Waiver ......................................... 1 Coordinated Care Organizations............................................................................. 2 Monitoring Beneficiaries’ Access to Care and Quality of Care............................... 3 Federal and State Requirements Related to CCOs ................................................. 4 The State Agency’s Oversight of CCOs.................................................................... 5

How We Conducted This Audit ........................................................................................... 5

FINDINGS......................................................................................................................................... 6

CCOs Did Not Comply With All Federal and State Requirements Related to Provider Credentialing ..................................................................................................... 6

A CCO Did Not Ensure That Services Were Provided Within the Scope of License of a Provider With a Restricted License or Report Providers With

CCOs Did Not Perform or Document All Minimum Required

Licensing Board Actions Against Them to the State Agency................................ 7 CCOs Did Not Credential All Provider Types ........................................................... 8

Credentialing Checks............................................................................................ 9

CCOs Did Not Comply With All Federal and State Requirements Related to Beneficiary Grievances and Appeals .............................................................................. 10

CCOs’ Resolution of Beneficiaries’ Grievances Did Not Comply With Their Contracts With the State Agency ..................................................... 10

CCOs Did Not Adjudicate Appeals in Compliance With Their Contracts

CCOs Submitted to the State Agency Inaccurate or Incomplete Data on

CCOs Did Not Perform Yearly Compliance Reviews of Grievances ...................... 12

With the State Agency........................................................................................ 13

Grievances and Appeals ..................................................................................... 14

CCOs Generally Complied With Federal and State Requirements Related to Time and Distance Standards and Timely Access Standards ......................................... 15

CCOs Generally Complied With Federal and State Requirements Related to Assignment of Primary Care Providers .......................................................................... 16

Oregon’s Oversight of Coordinated Care Organizations (A-09-18-03035)

CONCLUSION................................................................................................................................. 17

RECOMMENDATIONS ................................................................................................................... 17

STATE AGENCY COMMENTS ......................................................................................................... 17

OFFICE OF INSPECTOR GENERAL RESPONSE ................................................................................ 18

APPENDICES

A: Audit Scope and Methodology ..................................................................................... 19

B: State Agency Comments............................................................................................... 21

Oregon’s Oversight of Coordinated Care Organizations (A-09-18-03035)

INTRODUCTION

WHY WE DID THIS AUDIT

In 2012, Oregon was one of the first States to adopt a type of Medicaid accountable care organization when it established coordinated care organizations (CCOs). A CCO is a network of different types of participating providers that have agreed to work together in their local communities to provide coordinated care to Medicaid beneficiaries. As established by the Oregon Health Authority (State agency), CCOs are similar to traditional managed-care organizations but have some key differences, such as a community-based governance structure.

The State agency evaluates CCO performance based on access and quality measures that can result in incentive payments. The primary goals of the CCO model are to reduce the growth in statewide spending and improve statewide access to care and the quality of care. However, access to care has continued to be an issue since the CCOs were established. In its reports to the Centers for Medicare & Medicaid Services (CMS), the State agency consistently reported beneficiaries’ access to care as the highest reported grievance category. In addition, most CCOs had difficulty meeting their access-to-care incentive measures. Therefore, we selected four CCOs in Oregon to assess the State agency’s oversight.

OBJECTIVE

Our objective was to determine whether the State agency’s oversight ensured that four CCOs complied with selected Federal and State Medicaid requirements related to access to care and quality of care.

BACKGROUND

The Medicaid Program and the State Agency’s Waiver

The Medicaid program provides medical assistance to low-income individuals and individuals with disabilities. The Federal and State Governments jointly fund and administer the Medicaid program. At the Federal level, CMS administers the program. Generally, States administer their Medicaid programs in accordance with a CMS-approved State plan. However, section 1115 of the Social Security Act authorizes the Secretary of Health and Human Services to approve demonstration projects, under a waiver to the State plan, to assist in promoting the objectives of the Medicaid program. These waivers give States flexibility to design and improve their programs to better serve Medicaid populations.

The State agency administers Oregon’s Medicaid program through a waiver initially approved by CMS in 1994. The goal of the waiver was to expand eligibility and contain costs through managed care. Initially, various types of managed-care organizations, such as those providing physical, mental, and dental health care, contracted directly with the State agency. However, in

Oregon’s Oversight of Coordinated Care Organizations (A-09-18-03035) 1

a 2012 waiver amendment, with the establishment of CCOs, the State agency integrated those lines of care under the CCO umbrella.1

Coordinated Care Organizations

A CCO is a network of different types of participating providers (e.g., physical, mental, and dental health-care providers and those that provide addiction treatment) that have agreed to work together in their local communities to serve low-income beneficiaries who receive health care coverage through Medicaid. CCOs are similar to traditional managed-care organizations but have some key differences, such as more active roles by providers and community members in governance. CCOs are also accountable for health care access and quality. In addition to the goal of improving access to care and quality of care, CCOs focus on prevention and helping people manage chronic conditions, such as diabetes, to help reduce unnecessary emergency-room visits and give people support to be healthy. In 2016 and 2017, 16 CCOs operated in Oregon.

Responsibility and Governance of CCOs

CCOs are accountable for the health outcomes of the population they serve and bear financial responsibility for providing all covered health care services. In 2016, nearly 1.3 million beneficiaries received health care services from Oregon’s CCOs.

The section 1115 waiver requires that the governing board of each CCO be a partnership among health care providers and people in the community. The waiver also requires that each CCO establish a Community Advisory Council, of which at least 51 percent must be consumers, i.e., beneficiaries enrolled with the CCO. At least one member from the Community Advisory Council must be on the governing board.

The State Agency’s Contracts With CCOs and the Role of Subcontractors

Each CCO operates under a contract with the State agency (CCO contract). The provisions of the contract allow the CCO to subcontract the majority of the work performed under the contract. However, the contract states that the adjudication of final appeals may not be subcontracted.2 The four CCOs we selected for our audit subcontracted all or part of the activities covered by our audit. Although a CCO may subcontract certain activities to outside entities, the CCO is responsible for all duties included in its contract with the State agency and must monitor subcontractors’ performance.

1 Dental health care and nonemergency medical transportation (NEMT) services were added in 2014. NEMT services provide beneficiaries transportation to and from covered medical services. The types of vehicles that NEMT providers use include, but are not limited to, wheelchair vans and taxis.

2 Beneficiaries have the right to appeal adverse actions by CCOs. An appeal is a beneficiary request for a second review of a CCO’s adverse action, such as the denial or limitation of services. Adjudication is the CCO’s formal judgment on the appeal.


Capitated and Incentive Payments to CCOs

The State agency makes monthly capitated payments to the CCOs based on a set amount per member per month. In addition to these monthly capitated payments, the State agency makes incentive payments to the CCOs. The State agency bases the incentive payments on the CCOs’ incentive measures each year.

Monitoring Beneficiaries’ Access to Care and Quality of Care

Beneficiary access to care means having “the timely use of personal health services to achieve the best health outcomes.” Four components of access to care are: (1) having coverage, such as Medicaid coverage; (2) having a capable and qualified workforce, such as providers that are regularly credentialed and screened for issues that could affect the quality of care they provide; (3) the ability to get services in a timely manner; and (4) having a usual source for services, such as a primary care provider (PCP).3

Having a capable and qualified workforce affects both access to and quality of care. If providers are not properly credentialed and screened for issues (such as misconduct, malpractice, and sanctions), beneficiaries could be at risk of receiving poor quality of care. Beneficiaries have firsthand knowledge of their access to care and quality of care. If a beneficiary believes that either of these is insufficient, the beneficiary can remedy the situation by filing a grievance or an appeal with the CCO.

The State agency uses incentive measures to monitor access to care and quality of care. These incentive measures are developed using various data, including beneficiaries’ claim data and electronic health records and information gathered from beneficiary surveys. There have been small changes in the lineup of specific incentive measures. For 2016, the State agency made incentive payments based on 18 incentive measures. However, for 2017, it removed 1 measure, leaving 17 incentive measures.4

Access-to-Care Incentive Measures

An example of an access-to-care incentive measure is “Access to care.” This measure is the percentage of beneficiaries who said they were able to get appointments for and received care when needed. For this measure, a higher score is better. The State agency calculates this measure based on responses to

3 Agency for Healthcare Research and Quality, “Chartbook on Access to Health Care.” Available at https://www.ahrq.gov/research/findings/nhqrdr/chartbooks/access/elements.html. Accessed on March 31, 2020.

4 We did not verify the State agency’s calculation of incentive measures. We analyzed the results of only some of these measures to determine the State agency’s assessment of specific access-to-care and quality-of-care measures.

According to the State agency’s yearly performance reports, from 2013 through 2017, CCOs met their target for the “Access to care” incentive measure only 35 percent of the time.


https://www.ahrq.gov/research/findings/nhqrdr/chartbooks/access/elements.html

beneficiary surveys. The CCOs have no input on this measure and have consistently struggled to meet it. According to the State agency’s yearly performance reports, from 2013 through 2017, only a minority of CCOs met it.

Quality-of-Care Incentive Measures

An example of a quality-of-care incentive measure is “Diabetes care: HbA1c poor control.”5

This measure assesses the quality of diabetes care by measuring the percentage of adults with diabetes whose most recent A1c level was greater than 9 percent. For this measure, the goal is for most adults with diabetes to have an A1c level that is 9 percent or less. The State agency calculates this measure based on electronic health records. According to the State agency’s yearly performance reports, for 2016 and 2017, only a minority of CCOs met the goal.

Federal and State Requirements Related to CCOs

CCOs are required to follow waiver requirements as well as other Federal and State requirements, such as the Medicaid managed-care rules at 42 CFR part 438, Oregon Administrative Rules (OARs), and the terms of their contract with the State agency:6

• The State agency’s CMS-approved waiver outlines minimum requirements for the credentialing of providers by the CCOs (State agency waiver, attachment H, part I (IV)).7

• The OARs require a CCO to ensure that all participating providers are credentialed upon their initial contract with the CCO and recredentialed no less frequently than every 3 years (OARs § 410-141-3120(3)(a)).8 The OARs also require that CCOs have policies and procedures to ensure that time and distance and timely access standards are met (OARs § 410-141-3220).9

• The CCO contract requires that a CCO have a system in place for beneficiaries that includes both a grievance process and an appeals process that meet Federal regulations

5 The hemoglobin A1c test shows a person’s average level of blood sugar over the past 2 to 3 months. The higher the A1c level, the higher the person’s risk of having complications related to diabetes.

6 The waiver specifically waives two requirements from the Medicaid managed-care rules at 42 CFR part 438; however, those specific requirements did not affect our audit or findings.

7 Credentialing is the process of verifying the skills, training, and education of health care providers.

8 All references to the OARs in this report are to the version that was in effect as of January 1, 2017.

9 Time and distance standards define the limits of how far beneficiaries should be from the location of a PCP, in both minutes of travel time and number of miles. Timely access standards define how soon beneficiaries must be seen from the time they request services, depending on the type of care they need (e.g., urgent care or well care).


(CCO contract, exhibit I, § 1).10 The contract also requires that a CCO ensure that each beneficiary has an ongoing source of primary care appropriate to the beneficiary’s needs (CCO contract, exhibit B, part 4, § 2(k)).

The State Agency’s Oversight of CCOs

The State agency provides oversight of the CCOs in a variety of ways. In addition to monitoring access to care and quality of care through the incentive measures, the State agency oversees the CCOs by collecting and evaluating various CCO policies, procedures, and reports. The State agency also provides support and guidance to CCOs through collaborative meetings and technical assistance letters.

The State agency contracts with an external quality review organization (EQRO) to perform federally required reviews of CCOs. EQROs perform reviews of CCOs’ compliance with Federal and State regulations and contract provisions. In 2016, the State agency also contracted with the EQRO to review each CCO’s 2016 Delivery System Network (DSN) report, which described how the CCO would ensure that its network was adequate to provide access to covered services and how it would monitor timely access to care. The CCOs submit these reports yearly. In its reviews of the CCOs’ 2016 DSN reports, the EQRO found that many CCOs received numerous complaints related to beneficiaries’ access to nonemergency medical transportation (NEMT) services.

HOW WE CONDUCTED THIS AUDIT

We judgmentally selected four CCOs in Oregon and visited them to obtain a general understanding of their policies and procedures related to selected access-to-care and quality-of-care requirements. Specifically, we requested and reviewed data from 20 Medicaid beneficiaries at 3 CCOs and 30 Medicaid beneficiaries at 1 CCO who had been enrolled for at least 18 months of calendar years (CYs) 2016 and 2017 (audit period). We also requested and reviewed grievance and appeals data for CYs 2016 and 2017 from the State agency. After analyzing the data, we reviewed the following areas at each CCO: (1) the provider credentialing process, (2) beneficiary grievance and appeals processes, (3) compliance with time and distance standards, (4) compliance with timely access standards, and (5) PCP assignment.

We selected one CCO that served an urban area, one CCO that served a rural area, and two CCOs that served a mix of urban and rural areas. The four CCOs accounted for 41 percent of the beneficiary population for all CCOs and 44 percent of all payments to CCOs in CY 2017.11

We had no expectation that the four CCOs would be representative of all CCOs.

10 Federal regulations define a grievance as an expression of dissatisfaction about any matter other than an adverse benefit determination (42 CFR § 438.400(b)). Grievances include access-to-care and quality-of-care issues, as well as billing issues.

11 The percentages of beneficiary population and payments were similar in CY 2016.


We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix A contains the details of our audit scope and methodology.

FINDINGS

The State agency’s oversight did not ensure that four CCOs complied with selected Federal and State Medicaid requirements related to access to care and quality of care. The CCOs generally complied with Federal and State requirements related to time and distance standards and timely access standards, as well as requirements related to assignment of PCPs. However, the CCOs did not comply with requirements related to provider credentialing and beneficiary grievances and appeals:

• CCOs did not ensure that services were provided within the scope of license of a provider with a restricted license or report providers with licensing board actions against them and did not credential all provider types (e.g., mental health providers). Also, CCOs did not perform or document all minimum required credentialing checks.

• CCOs did not resolve or review beneficiary grievances appropriately and did not adjudicate appeals in compliance with their contracts with the State agency. For example, CCOs did not always act on grievances related to beneficiaries’ timely access to PCPs, dentists, or NEMT services. Also, CCOs submitted inaccurate or incomplete data on grievances and appeals, which the State agency used for oversight.

We identified findings related to provider credentialing and beneficiary grievances and appeals at each of the four CCOs. However, the specific findings and the extent of the findings identified at each CCO were not always the same. We discussed the specific findings at each CCO with the State agency.

These issues occurred because: (1) the State agency provided insufficient oversight of, and guidance to, the CCOs and (2) the CCOs provided insufficient oversight of, and guidance to, their subcontractors. Because not all providers were appropriately credentialed, there was an increased risk of poor quality of care. In addition, the mishandling of grievances and appeals may have reduced beneficiaries’ access to care and the quality of care.

CCOs DID NOT COMPLY WITH ALL FEDERAL AND STATE REQUIREMENTS RELATED TO PROVIDER CREDENTIALING

The CCOs did not ensure that services were provided within the scope of license of a provider with a restricted license, report providers with licensing board actions against them to the State


agency, credential all provider types, or perform or document all minimum required credentialing checks.

A CCO Did Not Ensure That Services Were Provided Within the Scope of License of a Provider With a Restricted License or Report Providers With Licensing Board Actions Against Them to the State Agency

During credentialing, a CCO must review professional misconduct or malpractice actions and determine whether Medicaid, Medicare, or other State agencies sanctioned providers. The CCO does this by checking a provider’s licensure status and National Practitioner Data Bank (NPDB) profile (State agency waiver, attachment H, part I (IV)).12 If the CCO identifies a sanction, such as a restricted license, the CCO is required to ensure that services are provided within the scope of license of each participating provider and that those providers are appropriately supervised according to their scope of practice (OARs § 410-141-3120(3)(c)(A)). In addition, the CCO must immediately notify the State agency’s Provider Services Unit if the CCO knows, or has a reason to know, that a provider’s license is subject to a licensing sanction (CCO contract, exhibit B, part 8, § 18(e)).

At one CCO, we identified two providers who had licensing board actions against them. One provider had a restricted license, and the CCO did not ensure that services were provided within the scope of his license. The CCO did not report either provider to the State agency:

• In 2015, the Oregon Board of Dentistry (the Board) restricted the license of a pediatric dentist because of concerns about his orthodontia work. The dentist, who was part of the network of a dental care organization that was subcontracted by the CCO, was required to either refer all orthodontia services outside his practice or have a Board-approved orthodontist independently review his orthodontia work every 6 months. Neither the CCO nor its subcontractor, the dental care organization, ensured that the dentist was practicing within the scope of his license restriction. According to the CCO, it relied on the Board to ensure that the dentist complied with the restriction. Information we obtained from an August 2019 Board order indicated that the dentist failed to comply with the 2015 Board order. Also, the Board found that he posed a serious threat to public health and safety, and, as a result, the Board suspended his license to practice dentistry.

• In 2015, the Board determined that another dentist provided unacceptable patient care and sanctioned her for extracting teeth without a patient’s consent. The sanction included a formal reprimand and a monetary fine.

In both instances, the CCO (or its subcontractors) had information about the licensing sanctions during the recredentialing process but did not report the dentists to the State agency as required.

12 Congress established the NPDB in 1986 to prevent providers from moving State to State without disclosure or discovery of previous damaging performance.


These issues occurred because the CCO provided insufficient oversight of the credentialing processes of its subcontractors. For CYs 2016 and 2017, the CCO reviewed certain aspects of credentialing (i.e., policies and procedures related to Office of Inspector General (OIG) exclusion checks and checks for criminal convictions) but did not review all aspects of credentialing or verify that procedures were actually followed. As a result, there was an increased risk of poor quality of care.

CCOs Did Not Credential All Provider Types

CCOs are required to ensure that all participating providers are credentialed upon their initial contract with the CCO and recredentialed no less frequently than every 3 years (OARs § 410-141-3120(3)(a)). CCOs are also required to have written policies and procedures for credentialing participating providers, including acute, primary, behavioral, and substance abuse providers, and the facilities used to deliver covered services (CCO contract, exhibit B, part 8, § 18(a)). When a CCO subcontracts duties, it remains accountable for those duties; the CCO must continually monitor the subcontractor’s performance and perform a formal review at least yearly (CCO contract, exhibit B, part 4, § 10(a)(7)).

The CCOs did not credential all provider types, i.e., mental health and substance abuse providers and hospital-based providers.

The CCOs subcontracted most of the processes for credentialing mental health and substance abuse providers to county mental health organizations and substance abuse organizations. However, three of the four CCOs did not oversee their subcontractors to ensure they credentialed those providers appropriately. In 2015, the EQRO found that the CCOs did not oversee the credentialing of nonlicensed mental health staff or substance abuse providers. One CCO stated that it attempted to review the credentialing of one of its mental health subcontractors and its substance abuse subcontractor for the first time in CY 2017. According to the CCO, the subcontractors pushed back, stating that they did not have to credential their employees because the State agency had certified the facilities to provide outpatient addiction and mental health services. However, although one aspect of the State agency’s review is related to the credentialing of the facility’s staff, the review does not encompass all the elements CCOs are required to check. The CCO officials further explained that they attempted to obtain State agency clarification but stated that the issue was not resolved as of the time of our audit. When we discussed the credentialing of mental health and substance abuse providers with State agency officials, they stated that they expect the CCOs to credential those providers, including nonlicensed mental health and substance abuse providers, such as certified drug and alcohol counselors.

In addition, the four CCOs did not credential, nor ensure that their subcontractors credentialed, hospital-based providers. The CCOs said that they followed National Committee for Quality Assurance standards, which state that it is not necessary to credential hospital-based


Required Credentialing Checks for CCOs

Verify licensure status

Review professional misconduct or malpractice actions

Determine whether providers were sanctioned

Review NPDB profile

Verify Federal exclusion status

Verify background checks, if applicable

providers.13 State agency officials, however, said that hospital-based providers are not exempt from CCO credentialing requirements.

The CCOs did not credential mental health, substance abuse, or hospital-based providers because the State agency did not provide formal guidance to the CCOs, beyond what was contained in the CCO contract, regarding credentialing. As a result, the State agency and the CCOs could not ensure that the subcontractors appropriately credentialed all providers in the network.

CCOs Did Not Perform or Document All Minimum Required Credentialing Checks

The State agency’s CMS-approved waiver outlines minimum requirements for the credentialing processes of CCOs. During credentialing, a CCO must verify participating providers’ licensure status; review professional misconduct or malpractice actions; determine whether Medicaid, Medicare, or other State agencies sanctioned providers; and review each provider’s NPDB profile (State agency waiver, attachment H, part I (IV)). In addition, CCOs may not employ or contract with providers excluded from participation in Federal health care programs (42 CFR § 438.214(d)). CCOs can verify provider exclusion status through the OIG List of Excluded Individuals and Entities as well as the System of Award Management website. For NEMT providers, drivers must pass a criminal background check (OARs § 410-141-3440(4)(b)).

Three of the four CCOs did not perform or document all minimum required checks during the credentialing or recredentialing process. We identified instances in which the CCOs did not check for misconduct or malpractice actions, review the provider’s NPDB profile, or verify provider exclusion status. For example, one CCO’s subcontractor (the county mental health organization) neglected to review a provider’s NPDB profile or verify Federal exclusion status until 2018 even though the provider had been employed by the county since 2015. In addition, one CCO did not verify that its NEMT subcontractor performed background checks of its drivers.

The State agency’s oversight of the CCOs included the EQRO review of the CCOs’ compliance with Federal and State regulations. The CCOs’ oversight of their subcontractors included a policies and procedures review of

13 The National Committee for Quality Assurance is an independent nonprofit agency that accredits health plans and uses data to measure the quality of providers and practices.


http:providers.13

selected aspects of credentialing. However, neither the State agency’s nor the CCOs’ oversight was sufficient to detect missing documentation in credentialing files. Without performing or documenting all minimum required credentialing checks, there was an increased risk of poor quality of care.

CCOs DID NOT COMPLY WITH ALL FEDERAL AND STATE REQUIREMENTS RELATED TO BENEFICIARY GRIEVANCES AND APPEALS

The CCOs did not resolve grievances in compliance with the CCO contract and did not perform the yearly formal compliance review of grievances that the OARs require. In addition, the CCOs did not adjudicate appeals in compliance with the contract and submitted to the State agency inaccurate or incomplete data on grievances and appeals.

CCOs’ Resolution of Beneficiaries’ Grievances Did Not Comply With Their Contracts With the State Agency

The CCO contract outlines requirements for the CCOs’ processing and resolution of beneficiary grievances:

• CCOs must accept grievances from a beneficiary either verbally or in writing (CCO contract, exhibit I, § 1(c)(1)).

• Once a CCO receives a beneficiary grievance, it must provide its decision on the grievance within 5 days or send the beneficiary a written notice that specifies the reason or reasons the CCO needs additional time. The CCO may extend the resolution of a grievance up to 30 days from the day it receives the grievance (CCO contract, exhibit I, § 3(c)(2)).

• The CCO’s notice of resolution must address each aspect of the grievance and explain the reason or reasons for the CCO’s decision (CCO contract, exhibit I, § 3(c)(3)).

• For a grievance that involves clinical issues, a health care professional with the appropriate clinical expertise must review the grievance (CCO contract, exhibit I, § 3(a)(3)(b)).

For some grievances, such as those related to NEMT accidents (see the example on page 12), verbal grievances, and grievances regarding issues with timely access to care and the quality of care, the four CCOs did not investigate the grievances or clearly resolve them. In several instances, a beneficiary called with a grievance, and the customer service representative asked whether the beneficiary wanted to file a written, or “formal,” grievance. If the beneficiary wanted to file a formal grievance, the representative either sent the beneficiary a written grievance form or referred the beneficiary to a website where a written grievance form could be obtained. The representative then closed the verbal grievance. If the beneficiary did not


Grievance Types

Access to Care

Interaction With Provider or Plan

Quality of Care

Consumer Rights

All Other

Approximately 20,000 grievances during 2-year audit period at 4 CCOs

want to file a formal grievance or wanted to remain anonymous, the representative closed the grievance without resolving the verbal grievance. (See the figure for a list of grievance types.)

Three of the four CCOs did not investigate or resolve grievances related to timely access to care that beneficiaries identified, and two CCOs did not have a health care professional review clinical issues categorized as quality-of-care grievances. Beneficiaries often called the CCOs to request different PCPs because they were unable to obtain services promptly from their assigned PCPs. For

Figure: Access to Care Was the Most Common Grievance Type

many of those grievances, the customer service representatives reassigned beneficiaries to other PCPs but did not further investigate or resolve the timely-access-to-care issue at the initial PCP, which did not comply with the CCO contract provision that CCOs require providers to meet standards for timely access to care.

During the 2-year audit period:

69 percent of all access grievances were related to NEMT services, and

13 percent of all access grievances were related to the beneficiary’s PCP.

In addition, although CCOs stated that health care professionals reviewed quality-of-care grievances, in a few instances no health care professionals reviewed clinical issues categorized as quality-of-care grievances. For example, a beneficiary called from the hospital with concerns about the diabetes care she had received from her PCP. She stated that the doctor overseeing her hospital care wanted to know why she had not been prescribed certain medications for her diabetes. The CCO categorized the grievance as a

quality-of-care grievance, but it was not reviewed by a health care professional. The beneficiary was assigned a new PCP at her request.

In addition, the CCOs did not: (1) resolve grievances in a timely manner (three CCOs), (2) send extension letters when a grievance was not resolved within 5 days (one CCO), or (3) specify in extension letters the reason that additional time was needed to resolve a grievance (three CCOs).

These issues occurred because the State agency provided insufficient guidance to and oversight of the CCOs. In general, the State agency provided limited guidance outside of its contract with the CCOs and limited oversight outside of its contracted EQRO reviews. In addition, the CCOs provided insufficient oversight of their subcontractors. Although some CCOs performed yearly reviews of their subcontractors, the reviews did not always include a review of the grievance


process, or the review included only a review of grievance policies and procedures. As a result, beneficiaries’ access to care and quality of care may have been reduced.

Example: A Quality-of-Care Grievance Related to Nonemergency Transportation Services Was Not Investigated or Resolved

A beneficiary was in an NEMT vehicle (a van) returning to her assisted living facility from an earlier appointment when the beneficiary was injured. A grievance was filed by an employee of the assisted living facility. According to the filed grievance documentation, the driver braked hard to avoid a rear-end collision, and the beneficiary “catapulted to the floor.” The beneficiary’s wheelchair was strapped down, but there was conflicting information about whether the beneficiary was secured in the wheelchair. The impact of the accident left the beneficiary with a broken leg and a cut near her eye. When the van arrived at the hospital, the beneficiary was still on the floor of the vehicle. Because of the accident, the beneficiary required surgery on her leg.

According to the NEMT subcontractor, it educated the driver on correct securing of wheelchairs and incident-reporting procedures. However, neither the subcontractor nor the CCO documented a grievance response to the beneficiary. The State agency reviewed the documentation for this grievance and determined that neither the NEMT subcontractor nor the CCO documented an appropriate investigation or resolution. Also, the State agency determined that there was no indication that the CCO followed up with the beneficiary to ensure that appropriate coordination of care was given as a result of her injury.

CCOs Did Not Perform Yearly Compliance Reviews of Grievances

If a CCO subcontracts the grievance process, the CCO must continually monitor the subcontractor’s performance and perform a formal compliance review of the subcontractor’s grievance process at least once a year to assess performance, deficiencies, or areas for improvement (OARs § 410-141-3260(12)). One CCO subcontracted the majority of the grievance resolution process. The other three CCOs handled the grievance resolution process related to physical health care services but subcontracted the grievance resolution processes related to mental health, dental, and NEMT services.

The four CCOs did not perform the yearly formal compliance review of grievances that the OARs require. Specifically, two CCOs performed general compliance reviews of their subcontractors every year; however, these reviews did not always include reviews of the subcontractors’ grievance processes. Two other CCOs did not begin to perform compliance reviews until CY 2017. Also, one CCO stated that it did not perform any review of its dental subcontractor. The CCO mistakenly believed that the State agency reviewed the subcontractor because that subcontractor contracted with many of the CCOs in Oregon.


These issues occurred because the State agency did not provide formal guidance to the CCOs, beyond what was contained in the CCO contract, regarding the grievance process. In addition, the State agency did not provide sufficient oversight of the CCOs, and the CCOs did not provide sufficient oversight of their subcontractors. Lastly, the State agency did not provide guidance to the CCOs to clarify the definition of a formal compliance review. As a result, neither the State agency nor the CCOs could ensure that beneficiaries had appropriate access to care and quality of care.

CCOs Did Not Adjudicate Appeals in Compliance With Their Contracts With the State Agency

The CCO contract outlines requirements for The Importance of processing and resolving appeals with which CCOs an Appeals Process must comply:

“A fundamental attribute of health • An overarching requirement is that a CCO

insurance is the existence of enforceable may not subcontract the adjudication of final

protections to ensure that applicants will appeals (CCO contract, exhibit B, part 4, get coverage . . . . The Medicaid program § 10(a)(2)(b)). is a vital source of health insurance for

60 million people with low incomes, • A CCO is required to notify beneficiaries in a people with disabilities, and seniors. But,

timely fashion when it takes adverse actions. none of the services offered by the For denial of a requested service, the Medicaid program are meaningful unless

people who are eligible are able to enroll contract requires the CCO to mail a notice of and, once enrolled, can access covered action (NOA) to the beneficiary within services . . . . A fair and efficient appeals 14 days (CCO contract, exhibit I, process is especially important in the

§ 2(b)(3)(a)).14 For a denial of payment, the context of capitated managed care,

CCO must mail the NOA at the time of any where there are economic incentives to

action that affects the claim (i.e., the denial underserve and the majority of of payment) (CCO contract, exhibit I, beneficiaries are mandatorily enrolled.” § 2(b)(2)).

Kaiser Family Foundation, A Guide to the

• A CCO is required to acknowledge receipt of Medicaid Appeals Process, March 2012 each appeal (CCO contract, exhibit I, § 3(a)(2)). In addition, a CCO must ensure that individuals who make decisions on appeals were not involved in any previous level of review, such as the denial of a prior authorization (CCO contract, exhibit I, § 3(a)(3)(a)).

• The CCO contract also specifies a timeline for the adjudication of appeals. For standard appeals, the contract requires a CCO to adjudicate each appeal no later than 14 days

14 The contract allows for a 14-day extension if the beneficiary requests it or if the CCO justifies a need for additional information and how an extension is in the beneficiary’s interest.


http:2(b)(3)(a)).14

from the day the CCO receives it (CCO contract, exhibit I, § 3(c)(4)).15 If a CCO needs more time, it must provide a written notice to the beneficiary documenting the reason for the delay. The contract requires the CCO to resolve expedited appeals within 3 business days (CCO contract, exhibit I, § 3(c)(5)).16

The four CCOs did not adjudicate appeals in compliance with their contracts with the State agency. Despite the fact that the 2014 EQRO report identified that CCOs subcontracted the adjudication of final appeals and that the State agency needed to provide additional guidance to the CCOs, three of the four CCOs continued to subcontract the adjudication of final appeals. For one appeal, not only did the CCO subcontract adjudication of the appeal, but the same physician who initially denied the prior authorization also denied the appeal. In addition, CCOs did not always: (1) provide NOAs or provide them in a timely manner, (2) acknowledge receiving appeals, (3) send extension letters, or (4) adjudicate appeals in a timely manner.

These issues occurred because the State agency did not provide formal guidance, beyond what was contained in the CCO contract, regarding the CCOs’ appeals process and did not provide oversight of that process. As a result, the CCOs could not ensure that beneficiaries’ appeal rights were protected. In addition, during our audit period, there was a discrepancy between the CCO contract and the OARs concerning the appeal resolution period. Although the contract stated that adjudication must take place within 14 days, the OARs stated that adjudication must take place within 16 days.

CCOs Submitted to the State Agency Inaccurate or Incomplete Data on Grievances and Appeals

The CCO contract requires that CCOs document all grievances and appeals using the Grievance Log and Summary Workbook (grievance workbook) and submit the grievance workbook to the State agency 45 days following the end of each calendar quarter (CCO contract, exhibit I, § 8(a)). In addition, CCOs must monitor the grievances internally on a monthly basis for completeness and accuracy (CCO contract, exhibit I, § 8(a)).

The four CCOs submitted inaccurate or incomplete data on grievances and appeals in their grievance workbooks. CCOs collect the data quarterly from their subcontractors, combine the data, and send the workbooks to the State agency. These grievance workbooks have detailed spreadsheets that show individual information on grievances and appeals as well as summary spreadsheets that roll up the individual information. The spreadsheets include several pieces of data, such as categories of grievances, results of grievances, results of adjudication, dates of grievances and appeals, and dates of resolution or adjudication.

15 The OARs require a CCO to adjudicate each appeal no later than 16 days from the day the CCO receives it (OARs § 410-141-3262(9)). After we had issued our draft report, we determined that the 2018 CCO contract contained language describing the appeal resolution period that was consistent with the OARs.

16 See footnote 14.


http:3(c)(5)).16http:3(c)(4)).15

and Distance Standards

Urban ~ 30 minutes or 30 miles

Rural ~ 60 minutes or 60 miles

Our review of a judgmental sample of grievances and appeals found that much of the grievance and appeals data was inaccurate. In addition, descriptions of grievance resolutions included in the detailed spreadsheets were sometimes incomplete. For example, some subcontractors reported grievance resolutions as “Educated Member” or “Contacted Provider/Documented,” which did not provide details of the grievance or its resolution. Also, the summary spreadsheets often could not be reconciled with the detailed spreadsheets. State agency officials stated that they relied on the summary spreadsheets for oversight of CCOs.

These issues occurred because the State agency did not provide sufficient guidance to the CCOs. Although the State agency provided instructions to the CCOs on how to complete the grievance workbook, the instructions were not sufficient. For example, the State agency instructed the CCOs to provide a brief narrative of the grievance resolution but did not define or provide examples of an acceptable resolution. Without complete and accurate data, the State agency may not be able to ensure that the CCOs are meeting the terms of the contract.

CCOs GENERALLY COMPLIED WITH FEDERAL AND STATE REQUIREMENTS RELATED TO TIME AND DISTANCE STANDARDS AND TIMELY ACCESS STANDARDS

The OARs generally require that CCOs have policies and procedures to ensure that 90 percent of their enrolled beneficiaries in each service area have routine travel time or distance to the location of their PCP that does not exceed the community standard (OARs § 410-141-3220(4)).17 In addition, the CCOs must have an access plan that establishes standards for access, outlines how capacity is determined, and establishes procedures for monitoring of capacity and access (OARs § 410-141-3220(5)). The OARs also define timely access standards for emergency, urgent, and well care; emergency, urgent, and routine dental care; and non-urgent behavioral health care. For example, CCOs generally must ensure that beneficiaries receive urgent dental care within 1 to 2 weeks and well care within 4 weeks (OARs § 410-141-3220(8)).

The CCOs generally complied with Federal and State requirements related to time and distance standards and timely access standards.

Generally, for time and distance standards, the four CCOs used the 30-minute/30-mile standard18 (for urban areas) or the 60-minute/60-mile standard (for rural areas) rather than a community standard. (See the graphic to the left.) The CCOs or subcontractors had access plans and performed network adequacy analyses

17 “Community standard” means typical expectations for access to the health care delivery system in the beneficiary’s community of residence.

18 This standard means that a beneficiary’s routine travel time to a PCP is less than or equal to 30 minutes or that the beneficiary lives less than or equal to 30 miles from the PCP.


http:3220(4)).17

Access Standards

Emergency Care Immediately

Urgent Care s 72 Hours

Well Care s 4 Weeks

Emergency Dental Care s 24 Hours

Urgent Dental Care s 1-2 Weeks

Routine Dental Care s 12 Weeks

Non-urgent Behavioral s 2 Weeks Health Care

comparing the geographical locations of their providers with the locations of enrolled beneficiaries. However, one CCO did not have a system to ensure that it performed its analyses using the actual addresses of the providers’ practices instead of their mailing addresses.

In addition, our review of judgmentally selected beneficiaries’ claims identified one instance in which a CCO did not meet timely access standards. (See the graphic to the right for the standards for different types of care.) In this instance, a primary care dentist referred a beneficiary to another dentist for necessary care and documented that the request was urgent. The referred dentist did not see the beneficiary for more than 3 weeks, which was longer than the 1 to 2 weeks for urgent dental care specified by the OARs.

Although the CCOs generally complied with timely access standards when beneficiaries were able to schedule appointments, we identified several instances (discussed in the section “CCOs’ Resolution of Beneficiaries’ Grievances Did Not Comply With Their Contracts With the State Agency”) in which the CCOs did not address the timely access component of grievances when beneficiaries reported that they were not able to make appointments in a timely manner.

We also identified two instances in which providers referred beneficiaries to specialists who could not see the beneficiaries for anywhere from 8 weeks to 9 months. However, there were no timely access requirements for specialists during our audit period.

CCOs GENERALLY COMPLIED WITH FEDERAL AND STATE REQUIREMENTS RELATED TO ASSIGNMENT OF PRIMARY CARE PROVIDERS

The CCO contract requires that the CCOs ensure that each beneficiary has an ongoing source of primary care appropriate to the beneficiary’s needs and a person or an entity formally designated as primarily responsible for coordinating the beneficiary’s health care services (CCO contract, exhibit B, part 4, § 2(k)).

The CCOs generally complied with Federal and State requirements related to assignment of PCPs. Specifically, all of the judgmentally selected beneficiaries we reviewed were assigned to PCPs. However, one CCO assigned a male beneficiary to a PCP specializing in obstetrics and gynecology.


CONCLUSION

The four CCOs generally complied with Federal and State requirements related to time and distance standards and timely access standards, as well as requirements related to assignment of PCPs. However, the State agency’s oversight did not ensure that the four CCOs complied with requirements related to provider credentialing and beneficiary grievances and appeals. As a result, there was an increased risk of poor quality of care because not all providers were appropriately credentialed. In addition, the mishandling of grievances and appeals may have reduced beneficiaries’ access to care and the quality of care. These issues occurred because: (1) the State agency provided insufficient oversight of, and guidance to, the CCOs and (2) the CCOs provided insufficient oversight of, and guidance to, their subcontractors.

RECOMMENDATIONS

We recommend that the Oregon Health Authority:

• provide additional guidance to CCOs on the processes for provider credentialing and for beneficiary grievances and appeals,

• provide additional guidance to CCOs on monitoring subcontractors,

• take actions to ensure that CCOs do not subcontract the adjudication of final appeals, and

• take actions to ensure that the data that CCOs submit on grievances and appeals in the grievance workbooks are accurate and complete.

STATE AGENCY COMMENTS

In written comments on our draft report, the State agency said that it acknowledged our findings, supported our recommendations, and was committed to making improvements for the areas in which our findings indicated areas of concern. The State agency also said that its 2020 contract with the CCOs includes a significant expansion of CCO requirements and a renewed focus by the State agency on compliance with and accountability to Federal and State Medicaid requirements. In addition, the State agency provided information on actions that it had taken or planned to take to address our recommendations. The State agency’s comments are included in their entirety as Appendix B.

The State agency’s comments on our recommendations are summarized below:

• Regarding our first recommendation, the State agency described the CCO contract requirements related to the credentialing process, stated that it would determine the feasibility of universal application and credentialing procedures at the State level, and stated that it was seeking to provide needed support to CCOs in capturing and


maintaining accurate provider data. Regarding the grievance and appeals processes, the State agency said that it had issued guidance to reiterate CCO contract and State requirements.

• Regarding our second recommendation, the State agency agreed with the recommendation. The State agency described new CCO reporting requirements and additional CCO deliverables that require greater documentation of the work conducted by subcontractors and CCO oversight of that work. The State agency said that it had provided guidance documents and submission templates for many of these deliverables and, through the efforts of the reconstituted Quality Assurance and Contract Oversight unit, the processes associated with submitting deliverables are being examined and standardized processes are being developed. In addition, the State agency said that it had submitted a budgetary request to fund four additional members of the Quality Assurance and Contract Oversight unit. The State agency also said that, based on the volume of grievances, it had placed added emphasis on addressing NEMT concerns. Finally, the State agency said that it was undertaking an initiative to make improvements to the process of handling member and provider complaints.

• Regarding our third recommendation, the State agency agreed with the recommendation and stated that it was working with CCOs to ensure that they meet the CCO contract’s requirement that CCOs shall not subcontract the adjudication of appeals, including reviewing CCO policies and procedures related to appeals and grievances. The State agency also said that its Quality Assurance and Contract Oversight unit was working with the Hearings unit to identify cases in which the appeals process conducted by a CCO is not compliant with the CCO contract and Federal and State regulations.

• Regarding our fourth recommendation (the fifth recommendation in our draft report), the State agency said that it recognizes the value of ensuring that data submitted by CCOs regarding grievances and appeals are accurate and complete. The State agency described its oversight of the data that CCOs submit in the grievance workbooks.

Regarding our draft report’s recommendation that the State agency take actions to make the language in the CCO contract related to the appeal resolution period consistent with the OARs (our original fourth recommendation), the State agency said that this discrepancy between the language in the CCO contract and the OARS was resolved in the 2018 CCO contract. The State agency also said that it would work to ensure that the timelines for appeals are met through the review of CCO appeal and grievance policies and procedures.

OFFICE OF INSPECTOR GENERAL RESPONSE

We verified that the 2018 CCO contract contained language describing the appeal resolution period that was consistent with the OARs. Therefore, we revised our final report to remove the recommendation related to making the language in the CCO contract consistent with the OARS.


APPENDIX A: AUDIT SCOPE AND METHODOLOGY

SCOPE

We judgmentally selected four CCOs in Oregon and obtained a general understanding of their policies and procedures related to selected access-to-care and quality-of-care requirements. Specifically, we requested and reviewed data from 20 Medicaid beneficiaries at 3 CCOs and 30 Medicaid beneficiaries at 1 CCO who had been enrolled for at least 18 months of CYs 2016 and 2017. We also requested and reviewed grievance and appeals data for CYs 2016 and 2017 from the State agency. After analyzing the data, we reviewed the following areas at each CCO: (1) the provider credentialing process, (2) beneficiary grievance and appeals processes, (3) compliance with time and distance standards, (4) compliance with timely access standards, and (5) PCP assignment.

We selected one CCO that served an urban area, one CCO that served a rural area, and two CCOs that served a mix of urban and rural areas. The four CCOs accounted for 41 percent of the beneficiary population for all CCOs and 44 percent of all payments to CCOs in CY 2017. We had no expectation that the four CCOs would be representative of all CCOs.

We did not assess the State agency’s or CCOs’ overall internal control structures. Rather, we limited our audit of internal controls to those applicable to our objective.

We conducted our audit from April 2018 to September 2019, which included fieldwork at the State agency offices in Salem, Oregon, and at the four CCO offices.

METHODOLOGY

To accomplish our objective, we:

• reviewed Federal and State requirements related to access to care and quality of care applicable to the CCOs;

• reviewed the CYs 2016 and 2017 contracts between the CCOs and the State agency;

• discussed applicable Federal and waiver requirements with CMS officials;

• discussed with State agency officials applicable State requirements and the State agency’s oversight of the CCOs;

• reviewed the CYs 2014 through 2017 EQRO reports and identified issues and recommendations reported by the EQRO;


• visited 4 CCOs and discussed with CCO officials their processes for credentialing and grievances and appeals, determining and ensuring compliance with time and distance and timely access standards, and PCP assignment;

• judgmentally selected 20 Medicaid beneficiaries at 3 CCOs and 30 Medicaid beneficiaries at 1 CCO who were enrolled with the CCOs for 18 of the 24 months of our audit period;

• requested demographic, enrollment, and PCP assignment data for the selected beneficiaries, as well as data related to the providers that the beneficiaries saw and the claims for services they received;

• compared each beneficiary’s address with the address of the beneficiary’s assigned PCP to determine whether the beneficiary’s distance from the PCP was within time and distance standards;

• selected and reviewed a judgmental sample of providers to evaluate the CCOs’ credentialing process;

• selected and reviewed a judgmental sample of beneficiary claims to determine whether timely access standards were met (i.e., attempted to determine the amount of time that passed between the dates the services were scheduled and the dates of service);

• requested from the State agency each CCO’s quarterly grievance workbooks for CYs 2016 and 2017 and selected a judgmental sample of 100 grievances and 50 appeals to evaluate each CCO’s grievance and appeals processes; and

• discussed the results of our audit with State agency officials, including the specific findings at each of the 4 CCOs.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.


To:

From:

Subject:

HEALTH SYSTEMS DIVISION ] [ C~lt h -K-at_e_B-ro_w_n_, G- o-v-er-no_r____________________ Authority

August 12, 2020

Lori A. Ahlstrand Regional Inspector General for Audit Services Office of Inspector General Department of Health and Human Services

Dave Inbody CCO Operations Manager

Health Systems Division Oregon Health Authority

Response to OIG Audit Report

500 Summer St NE E35 Salem, OR, 97301

Voice: 503-945-5772 or 800-527-5772 Fax: 503-373-7689

TTY: 71 1 www.oregon.gov/OHA/HSD

In response to the draft report from the U.S. Department of Health and Human Services, Office of Inspector General

(DIG) entitled Oregon's Oversight Did Not Ensure Thot Four Coordinated-Care Organizations Complied with Selected

Medicaid Requirements Related to Access to Care and Quality of Care, the Oregon Health Authority (OHA)

acknowledges the findings and supports the five recommendations identified.

On January 1, 2020, new five-year contracts became effective with 12 entities to operate as coordinated care

organizations (CCDs) in 15 service areas. This new contract period, referred to as CCO 2.0, includes a significant

expansion of CCO requirements and a renewed focus by OHA on compliance and accountability to federal and state

Medicaid requirements. The findings provided by DIG as part of this report wi ll provide critical insight in OHA's

continued commitment to member access to care and quality of care.

OHA is pleased that DIG found CCOs were generally com pliant with federal and state requirements related to time

and distance standards, timely access standards, and requirements related to assignment of primary care physicians.

Despite these positive findings, OHA will continue to evaluate these areas to ensure adequate access to all services

covered under CCO contract and state rules. This will be achieved through a variety of compliance and reporting

requirements, most notably the Delivery System Network (DSN) reporting and Compliance Monitoring Reviews

conducted by an external quality review organization (EQRO), in col laboration with OHA's Quality Assurance and

Contract Oversight unit. Since the OIG audit of CCOs occurred, DHA has contracted with a new EQRD, Health Services

Advisory Group (HSAG), to conduct this work. OHA is confident this work w ill be more thorough and extensive than

has been provided in the past.

For the areas in which DIG's findings indicated areas of concern, OHA is committed to making improvements. Based

on the findings identified in this report, DIG provided five recommendations:

Page 1 of 6

APPENDIX B: STATE AGENCY COMMENTS


#1: Provide additional guidance to CCOs on the processes for

provider credentialing and for beneficiary grievances and appeals

OHA Response:

The CCO contract, Exhibit B, Part 4, Section 6a. states the requirement for CCOs to have credentialing policies

and procedures as follows:

Contractor shall have written policies and procedures for collecting evidence of credentials, screening the

credentials, reporting credential information and recredentialing of Participating Providers including

Acute, primary, dental, behavioral, Substance Use Disorder Providers, and facilities used to deliver

Covered Services, consistent with PPACA Section 6402, 42 CFR 438.214, 42 CFR 455.400-455.470

(excluding 455.460), OAR 410-141-3510 and Exhibit G of this Contract, except as provided in Para. B, of

this Sec. 6, Ex. B, Part 4.

The CCO contract also requires the maintenance of records (Exhibit B, Part 4, Section 6f.) that documents

academic credentials, training received, licenses and certifications, and reports from the National Practitioner

Data Bank. All CCO providers are included in the DSN Report that CCOs submit to OHA on a quarterly basis. The

contract includes information about credentialing of providers designated by CMS as "moderate or high risk."

OHA convenes a monthly forum with CCOs to discuss operational matters. OHA has used this forum to solicit

questions from CCOs related to provider credentialing and will remind CCOs about the opportunity to submit

questions to the monthly forum and directly to OHA.

CCOs are required to monitor providers with respect to nine different criteria (Exhibit G, Section 26.). Also

included in the DSN Report is the description of five different CCO processes including the "Processes used to develop,

maintain and Monitor an appropriate Provider Network that is sufficient to provide adequate access to all services covered

under this Contract." (Exhibit G, Section 2c.(2)). Through the quarterly DSN Provider Capacity report submissions,

CCOs are expected to report the credentialing date of providers, which will allow OHA to determine if CCOs are

credentialing, and recredentialing, providers within the expected timeframes.

In the next 12 months, OHA will determine the feasibility of providing universal application and credentialing

procedures at the state level. Currently, OHA is responsible for credentialing for providers serving open card

members (fee for service)- those individuals who qualify for Medicaid but are not enrolled with a CCO.

Acknowledging the additional staffing requirements and technological changes necessary to implement this

initiative, it will likely require additional budgetary support.

Additional support for OHA, as well as CCOs, in provider credentialing may be the implementation of a provider

directory. The Oregon Health Information Technology (OHIT) unit is implementing a provider directory, which

will serve as a central repository for provider data drawn from state data, provider data, and third-party data.

Working directly with CCOs, OHIT is seeking to provide needed support to CCOs in capturing and maintaining

accurate provider data. Through engagement with the Quality Assurance & Contract Oversight unit,

opportunities to bolster the dat a collection associated with the quarterly DSN report are being explored.

Although this effort is still in an early stage of implementation, it offers a promising approach to the

management and oversight of provider credent ialing.

Page 2 of 6


early 2020, to address the findings related to appeals and grievances, OHA reviewed and approved CCO

appeal and grievance policies and procedures and the CCO member notice templates for Notice of Adverse

Benefit Determination (NOABD) and Notice of Appeal Resolution (NOAR). These reviews identified non

compliant elements with OHA requiring the CCOs to make corrections. In addition, OHA has issued guidance to

reiterate CCO contract and state rule requirements regarding verbal requests for appeal, grievance, and hearing

processes. Further, ongoing OHA review of CCO Appeals and Grievance Log and Summary Report (Exhibit I) will

ensure required elements are retained in NOABDs.

Owner: Dave Inbody, CCO Operations Manager

Contributors: OHA Management Team, Health Services Division Management Team, Licensing and Certification

unit, Business Information Systems unit, Oregon Health Information Technology (OHIT) unit

Implementation/Completion Dates: Initial work is underway and will continue through the length of the CCO

contract (December 31, 2024).

Recommendation #2: Provide additional guidance to CCOs on monitoring

subcontractors

OHA Response:

OHA agrees with this recommendation. This is a challenging consideration for OHA, as well as the CCOs. While

the new CCO contract seeks to address this issue through additional CCO deliverables and reporting

requirements, it is critical for OHA to remain diligent to ensure these requirements are met. Many of the new

deliverables require greater documentation of the work conducted by subcontractors and CCO oversight of this

work. Some examples include the requirement that each CCO develop a health equity plan, perform quarterly

language access and interpreter reporting, and perform quarterly non-emergent medical transportation (NEMT)

reporting. The CCO deliverables specific to subcontractor monitoring are annual reporting to identify all

subcontracted and delegated work, annual reporting on subcontractor performance, and submission of

subcontractor corrective action plans and updates to OHA. OHA has provided guidance documents and

submission templates for many of these deliverables, as well as direct assistance to support CCOs in successfully

submitting these deliverables.

Th is effort has been centralized with the reconstituted Qua lity Assurance and Contract Oversight unit. The

primary responsibility of this team is to ensure that CCO contractual requirements are achieved. In analyzing the

cha llenges to CCOs in meeting requirements during the first CCO contract period (2012-2019), the processes for

submitting CCO deliverables and reporting requirements were decentralized, inconsistent, and not always

clearly communicated. Through the efforts of this team, in association with the CCO Compliance Project, a multi

unit OHA workgroup, the processes associated with submitting deliverables are being examined and

standa rdized processes are being developed. Through centralized monitoring of deliverables, tra cking of

timeliness of submission, completeness of documentation, and quality of performance, OHA will be better able

to identify potential issues and support CCOs to improve their oversight of subcontractors.

Page 3 of 6


the significance of this undertaking, OHA has submitted a budgetary request for the 2021-2023

biennium to fund four additional members of the Quality Assurance and Contract Oversight unit, as well as

improvements in data collection, tracking, and reporting. Although a decision on this request will not be

determined until the next legislative session in 2021, it is a strong indication of the priority and significance OHA

has placed on this effort.

Based on the volume of grievances, added emphasis by OHA has been placed on addressing NEMT concerns.

OHA analysis indicates there is a large number of grievances in reference to NEMT. OIG's audit report indicates

that NEMT represents 69% of access to care grievances, which is the most common grievance type. Besides the

addition of quarterly NEMT reporting, OHA undertook a corrective action plan specific to the NEMT issues

associated with one CCO. This effort resulted in frequent tracking of on-time performance and provider no

shows. OHA has also conducted bi-weekly meetings with the CCO to review NEMT operations and ensure access

to care and quality of member care. This work continues and has provided valuable insight to the challenges

faced in the delivery of NEMT services.

The Health Services Division of OHA is also undertaking an initiative to make improvements to the process of

handling member and provider complaints. This work seeks to standardize and automate processes for

submitting complaints, tracking progress, resolving issues promptly, and analyzing data to better understand the

root causes for areas of concern.


Contributors: Quality Assurance & Contract Oversight Unit, Transformation Center, Provider Services unit, CCOs

Implementation/Completion Dates: Work is underway and will continue through the length of the CCO contract

(December 31, 2024).

Recommendation #3: Take actions to ensure that CCOs do not subcontract the

adjudication of final appeals

OHA Response:

OHA agrees with this recommendation and has taken steps to address it. Currently, the CCO contract addresses

this requirement in Exhibit I, Section le.(11) as follows:

Contractor [CCO] shall not Delegate to a Subcontractor or Participating Provider the Adjudication of an

Appeal, in accordance with OAR 410-141-3875(14).

OHA is working with CCOs to ensure this requirement is being met. This has included identification and

verification of the process followed for resolution of a member appeal in response to a NOABD, most notably if

there is an indication that subcontractors were operating on behalf of the CCO. This included OHA review of CCO

policies and procedures related to appeals and grievances, review of NOAR templates, and review by OHA of

CCOs' subcontracted and delegated work reports. The Quality Assurance and Contract Oversight unit is also

working closely with the OHA's Hearings unit to identify cases in which the appeals process conducted by the

CCO is not compliant with the CCO contract and state or federal regulations. Ongoing discussions with CCOs

Page 4 of 6


sought to better define the circumstances in which it is acceptable for subcontractors to act and those

circumstances when CCOs are required to act. This work reiterated the requirement for all CCO deliverable

requirements to be submitted by CCOs.


Contributors: Quality Assurance & Contract Oversight Unit, Health Services Division, CCOs

Implementation/Completion Dates: Work is underway and will continue through the length of the CCO contract

(December 31, 2024).

Recommendation #4: Take actions to make the language in the CCO contract related

to the appeal resolution period consistent with the OARs * OHA Response:

This discrepancy was resolved in the 2018 CCO contract and remains in alignment with the OAR, which was

renumbered as OAR 410-141-3890 effective January 1, 2020. The current contract language, which appears in

Exhibit I, Section 4b.(2)(a) is as follows:

Contractor {CCO} shall resolve standard Appeals as expeditiously as a Member's health condition

requires and no later than sixteen (16) days from the day Contractor received the Appeal. Contractor

may extend this timeframe by up to fourteen (14) days 1f:

i. The Member requests the extension; or

ii. Contractor shows (to the satisfaction of OHA, upon its request) that there is need for additional

information and how the delay is in the affected Member's interest.

This is consistent with the language in OAR 410-141-3890(4) which is as follows:

For standard resolution of an appeal and notice to the affected parties, the MCE shall establish a

timeframe that is no longer than 16 days from the day the MCE receives the appeal.

The extension language in the CCO contract is consistent with OAR 410-141-3890(4)(b):

The MU may extend the timeframes from section (3) of this rule by up to 14 days if:

(A) The member requests the extension; or

(8) The MCE shows to the satisfaction of the Authority upon its request that there is need for additional

information and how the delay is in the member's interest.

OHA will work to ensure these timelines are met through the review and approval of CCO appeal and grievance

policies and procedures and the CCO member notice templates for NOABDs and NOARs.


Contributors: Quality Assurance & Contract Outsight unit

Page 5 of 6

* OIG Note: This recommendation was removed from the final report.


Dates: This issue was resolved with the new CCO contra ct effective January 1,

2020.

Recommendation #5: Take actions to ensure that the data that CCOs submit on

grievances and appeals in the grievance workbooks are accurate and complete

OHA Response:

OHA recognizes the value of ensuring data submitted by CCOs regarding grievances and appeals are accurate

and complete. CCOs are required to submit their Grievance and Appeals System Log on a quarterly basis, as well

as their Grievance System Report.

OHA selects a sample from the NOABDs listed in the Log within the ten days after the submission and provides it

to the CCO. The CCO then has 14 days to submit all associated NOABDs and Prior Authorization (PA)

documentation for the sample cases. OHA evaluates the NOABDs and PA documentation based on criteria in 21

areas of compliance. Upon completion of the evaluation, OHA provides each CCO with the results identifying any

areas requiring corrective action.

For each NOABD sample, the CCO must include the NOABD letter, Hearing Request Form, the Notice of Hearing

Rights, and the language translation and nondiscrimination statement. This is consistent with CCO contract

language appearing in Exhibit I, Section 10b.

Due to the COVID pandemic, OHA extended deadlines for 27 CCO deliverables and waived seven deliverables.

Neither the deadline for the Grievance and Appeals Log nor the Grievance System Report were altered.

Owner: Veronica Guerra, Quality Assurance and Contract Oversight Manager

Contributors: Quality Assurance and Contract Oversight Unit, CCOs, CCO Compliance Project Workgroup

Implementation/Completion Dates: Work is underway and will continue quarterly through the length of the

CCO contract (December 31, 2024).

/David G. Inbody/

David G. Inbody

CCO Operations Manager

Health Services Division

Oregon Health Authority

Page 6 of 6

Oregon’s Oversight of Coo

department of health and human servicesthese issues occurred because: (1) oregon provided...

Documents